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Common Requirements for Carrier-Grade NATs (CGNs) 
Abstract 


This document defines common requirements for Carrier-Grade NATs 
(CGNs). It updates RFC 4787. 


Status of This Memo 
This memo documents an Internet Best Current Practice. 


This document is a product of the Internet Engineering Task Force 


(IETF). It represents the consensus of the IETF community. It has 
received public review and has been approved for publication by the 
Internet Engineering Steering Group (IESG). Further information on 


BCPs is available in Section 2 of RFC 5741. 


Information about the current status of this document, any errata, 
and how to provide feedback on it may be obtained at 
http://www.rfc-editor.org/info/rfc6888. 


Copyright Notice 


Copyright (c) 2013 IETF Trust and the persons identified as the 
document authors. All rights reserved. 


This document is subject to BCP 78 and the IETF Trust’s Legal 
Provisions Relating to IETF Documents 
(http://trustee.ietf.org/license-info) in effect on the date of 
publication of this document. Please review these documents 
carefully, as they describe your rights and restrictions with respect 
to this document. Code Components extracted from this document must 
include Simplified BSD License text as described in Section 4.e of 
the Trust Legal Provisions and are provided without warranty as 
described in the Simplified BSD License. 
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1. Introduction 


With the shortage of IPv4 addresses, it is expected that more 
Internet Service Providers (ISPs) may want to provide a service where 
a public IPv4 address would be shared by many subscribers. Each 
subscriber is assigned a private address, and a Network Address 
Translator (NAT) [RFC2663] situated in the ISP’s network translates 
the traffic between private and public addresses. When a second IPv4 
NAT is located at the customer edge, this results in two layers of 
NAT. 


This service can conceivably be offered alongside others, such as 
IPv6 services or regular IPv4 service assigning public addresses to 
subscribers. Some ISPs started offering such a service long before 
there was a shortage of IPv4 addresses, showing that there are 
driving forces other than the shortage of IPv4 addresses. One 
approach to CGN deployment is described in [RFC6264]. 


This document describes behavior that is required of those multi- 
subscriber NATs for interoperability. It is not an IETF endorsement 
of CGNs or a real specification for CGNs; rather, it is just a 
minimal set of requirements that will increase the likelihood of 
applications working across CGNs. 


Because subscribers do not receive unique IPv4 addresses, Carrier- 
Grade NATs introduce substantial limitations in communications 
between subscribers and with the rest of the Internet. In 
particular, it is considerably more involved to establish proxy 
functionality at the border between internal and external realms. 
Some applications may require substantial enhancements, while some 
others may not function at all in such an environment. Please see 
"Issues with IP Address Sharing" [RFC6269] for details. 
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This document builds upon previous works describing requirements for 
generic NATs [RFC4787] [RFC5382] [RFC5508]. These documents, and their 
updates if any, still apply in this context. What follows are 
additional requirements, to be satisfied on top of previous ones. 


2. Terminology 
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", “SHALL NOT", 
"SHOULD", “SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 


document are to be interpreted as described in [RFC2119]. 


Readers are expected to be familiar with "Network Address Translation 
(NAT) Behavioral Requirements for Unicast UDP" [RFC4787] and the 


terms defined there. The following additional term is used in this 
document: 
Carrier-Grade NAT (CGN): A NAT-based [RFC2663] logical function used 


to share the same IPv4 address among several subscribers. A CGN 
is not managed by the subscribers. 


Note that the term "carrier-grade" has nothing to do with the 
quality of the NAT; that is left to discretion of implementers. 
Rather, it is to be understood as a topological qualifier: the 
NAT is placed in an ISP’s network and translates the traffic of 
potentially many subscribers. Subscribers have limited or no 
control over the CGN, whereas they typically have full control 
over a NAT placed on their premises. 


Note also that the CGN described in this document is IPv4-only. 
IPv6 address translation is not considered. 


However, the scenario in which the IPv4-only CGN logical 
function is used may include IPv6 elements. For example, Dual- 
Stack Lite (DS-Lite) [RFC6333] uses an IPv4-only CGN logical 
function in a scenario making use of IPv6 encapsulation. 
Therefore, this document would also apply to the CGN part of 
DS-Lite. 
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Figure 1 summarizes a common network topology in which a CGN 
operates. 
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(IP addresses are only for example purposes) 
Figure 1: CGN Network Topology 


Another possible topology is one for hotspots, where there is no 
customer premise or customer premises equipment (CPE), but where a 
CGN serves a bunch of customers who don’t trust each other; hence, 
fairness is an issue. One important difference with the previous 
topology is the absence of a second layer of NAT. This, however, has 
no impact on CGN requirements since they are driven by fairness and 
robustness in the service provided to customers, which applies in 
both cases. 


3. Requirements for CGNs 
What follows is a list of requirements for CGNs. They are in 
addition to those found in other documents such as [RFC4787], 
[RFC5382], and [RFC5508]. 
REQ-1: If a CGN forwards packets containing a given transport 
protocol, then it MUST fulfill that transport protocol’s 
behavioral requirements. Current applicable documents are as 


follows: 


a. "NAT Behavioral Requirements for Unicast UDP" [RFC4787] 
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b. “Network Address Translation (NAT) Behavioral Requirements for 
TCP" [RFC5382] 


Gu "NAT Behavioral Requirements for ICMP" [RFC5508] 
d. "Network Address Translation (NAT) Behavioral Requirements for 
the Datagram Congestion Control Protocol (DCCP)" [RFC5597] 


Any future NAT behavioral requirements documents for IPv4 
transport protocols will impose additional requirements for CGNs 
on top of those stated here. 


Justification: It is crucial for CGNs to maximize the set of 
applications that can function properly across them. The IETF has 
documented the best current practices for UDP, TCP, ICMP, and 
DCCP. 


REQ-2: A CGN MUST have a default "IP address pooling" behavior of 
"Paired" (as defined in Section 4.1 of [RFC4787]). A CGN MAY 
provide a mechanism for administrators to change this behavior on 
an application protocol basis. 


* When multiple overlapping internal IP address ranges share the 
same external IP address pool (e.g., DS-Lite [RFC6333]), the 
"IP address pooling" behavior applies to mappings between 
external IP addresses and internal subscribers rather than 
between external and internal IP addresses. 


Justification: This stronger form of REQ-2 from [RFC4787] is 
justified by the stronger need for not breaking applications that 
depend on the external address remaining constant. 


Note that this requirement applies regardless of the transport 
protocol. In other words, a CGN must use the same external IP 
address mapping for all sessions associated with the same internal 
IP address, be they TCP, UDP, ICMP, something else, or a mix of 
different protocols. 


The justification for allowing other behaviors is to allow the 
administrator to save external addresses and ports for application 
protocols that are known to work fine with other behaviors in 
practice. However, the default behavior MUST be "Paired". 


REQ-3: The CGN function SHOULD NOT have any limitations on the size 
or the contiguity of the external address pool. In particular, 
the CGN function MUST be configurable with contiguous or non- 
contiguous external IPv4 address ranges. 
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Justification: Given the increasing rarity of IPv4 addresses, it is 
becoming harder for an operator to provide large contiguous 
address pools to CGNs. Additionally, operational flexibility may 
require non-contiguous address pools for reasons such as 
differentiated services, routing management, etc. 


The reason for having SHOULD instead of MUST is to account for 
limitations imposed by available resources as well as constraints 
imposed for security reasons. 


REQ-4: A CGN MUST support limiting the number of external ports (or, 
equivalently, "identifiers" for ICMP) that are assigned per 
subscriber. 


a. Per-subscriber limits MUST be configurable by the CGN 
administrator. 


b. Per-subscriber limits MAY be configurable independently per 
transport protocol. 


c. Additionally, it is RECOMMENDED that the CGN include 
administrator-adjustable thresholds to prevent a single 
subscriber from consuming excessive CPU resources from the CGN 
(e.g., rate-limit the subscriber’s creation of new mappings). 


Justification: A CGN can be considered a network resource that is 
shared by competing subscribers. Limiting the number of external 
ports assigned to each subscriber mitigates the denial-of-service 
(DoS) attack that a subscriber could launch against other 
subscribers through the CGN in order to get a larger share of the 


resource. It ensures fairness among subscribers. Limiting the 
rate of allocation mitigates a similar attack where the CPU is the 
resource being targeted instead of port numbers. However, this 


requirement is not a MUST because it is very hard to explicitly 
call out all CPU-consuming events. 


REQ-5: A CGN SHOULD support limiting the amount of state memory 
allocated per mapping and per subscriber. This may include 
limiting the number of sessions, the number of filters, etc., 
depending on the NAT implementation. 


a. Limits SHOULD be configurable by the CGN administrator. 


b. Additionally, it SHOULD be possible to limit the rate at which 
memory-consuming state elements are allocated. 
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Justification: A NAT needs to keep track of TCP sessions associated 
with each mapping. This state consumes resources for which, in 
the case of a CGN, subscribers may compete. It is necessary to 
ensure that each subscriber has access to a fair share of the 
CGN’s resources. Limiting the rate of allocation is intended to 
prevent CPU resource exhaustion. Item "B" is at the SHOULD level 
to account for the fact that means other than rate limiting may be 
used to attain the same goal. 


REQ-6: It MUST be possible to administratively turn off translation 
for specific destination addresses and/or ports. 


Justification: It is common for a CGN administrator to provide 
access for subscribers to servers installed in the ISP’s network 
in the external realm. When such a server is able to reach the 
internal realm via normal routing (which is entirely controlled by 
the ISP), translation is unneeded. In that case, the CGN may 
forward packets without modification, thus acting like a plain 
router. This may represent an important efficiency gain. 


Figure 2 illustrates this use-case. 


X1:xl1 XL xl X2:x2 
+---+from X1:xl +---+from X1:xl St 
i ‘i, to x22  t | to X2:x2 |s| 
| 1 |>>>>>>>>>>>>| c |>>>>>>>>>>>>>>| e | 
|a G f || 
e |<<<<<<<<<<<<| N |<<<<<<<<<<<<<<| v 
| n |from X2:x2 from X2:x2 e | 
| t | to X1:x1 | | to X1:x1 |r| 
+---+ +---+ +---+ 


Figure 2: CGN Pass-Through 


REQ-7: It is RECOMMENDED that a CGN use an "endpoint-independent 
filtering" behavior (as defined in Section 5 of [RFC4787]). If it 
is known that "Address-Dependent Filtering" does not cause the 
application-layer protocol to break (how to determine this is out 
of scope for this document), then it MAY be used instead. 


Justification: This is a stronger form of REQ-8 from [RFC4787]. 
This is based on the observation that some games and peer-to-peer 


applications require EIF for the NAT traversal to work. In the 
context of a CGN, it is important to minimize application 
breakage. 
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REQ-8: Once an external port is deallocated, it SHOULD NOT be 
reallocated to a new mapping until at least 120 seconds have 
passed, with the exceptions being: 


a. If the CGN tracks TCP sessions (e.g., with a state machine, as 
in Section 3.5.2.2 of [RFC6146]), TCP ports MAY be reused 
immediately. 

b. If external ports are statically assigned to internal 


addresses (e.g., address X with port range 1000-1999 is 
assigned to subscriber A, 2000-2999 to subscriber B, etc.), 
and the assignment remains constant across state loss, then 
ports MAY be reused immediately. 


c. If the allocated external ports used address-dependent or 
address-—and-port-—dependent filtering before state loss, they 
MAY be reused immediately. 


The length of time and the maximum number of ports in this state 
MUST be configurable by the CGN administrator. 


Justification: This is necessary in order to prevent collisions 
between old and new mappings and sessions. It ensures that all 
established sessions are broken instead of redirected to a 
different peer. 


The exceptions are for cases where reusing a port immediately does 
not create a possibility that packets would be redirected to the 


wrong peer. One can imagine other exceptions where mapping 
collisions are avoided, thus justifying the SHOULD level for this 
requirement. 


The 120 seconds value corresponds to the Maximum Segment Lifetime 
(MSL) from [RFC0793]. 


Note that this requirement also applies to the case when a CGN 
loses state (due to a crash, reboot, failover to a cold standby, 


etc.). In that case, ports that were in use at the time of state 
loss SHOULD NOT be reallocated until at least 120 seconds have 
passed. 


REQ-9: A CGN MUST implement a protocol giving subscribers explicit 
control over NAT mappings. That protocol SHOULD be the Port 
Control Protocol [RFC6887]. 


Justification: Allowing subscribers to manipulate the NAT state 


table with PCP greatly increases the likelihood that applications 
will function properly. 
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A study of PCP-less CGN impacts can be found in [NAT444]. Another 
study considering the effects of PCP on a peer-to-peer file 
sharing protocol can be found in [BITTORRENT]. 


REQ-10: CGN implementers SHOULD make their equipment manageable. 
Standards-—based management using standards such as "Definitions of 
Managed Objects for NAT" [RFC4008] is RECOMMENDED. 


Justification: It is anticipated that CGNs will be primarily 
deployed in ISP networks where the need for management is 


critical. This requirement is at the SHOULD level to account for 
the fact that some CGN operators may not need management 
functionality. 


Note also that there are efforts within the IETF toward creating a 
MIB tailored for CGNs (e.g., [NAT-MIB]). 


REQ-11: When a CGN is unable to create a dynamic mapping due to 
resource constraints or administrative restrictions (i.e., 
quotas): 


a. it MUST drop the original packet; 


b. it SHOULD send an ICMP Destination Unreachable message with 
code 1 (Host Unreachable) to the sender; 


c. it SHOULD send a notification (e.g., SNMP trap) towards a 
management system (if configured to do so); and 


d. it MUST NOT delete existing mappings in order to "make room" 
for the new one. (This only applies to normal CGN behavior, 
not to manual operator intervention.) 


Justification: This is a slightly different form of REQ-8 from 
[RFC5508]. Code 1 is preferred to code 13 because it is listed as 
a "soft error" in [RFC1122], which is important because we don’t 
want TCP stacks to abort the connection attempt in this case. See 
[RFC5461] for details on TCP’s reaction to soft errors. 


Sending ICMP errors and SNMP traps may be rate-limited for 
security reasons, which is why requirements B and C are SHOULDs, 
not MUSTs. 


Applications generally handle connection establishment failure 
better than established connection failure. This is why dropping 
the packet initiating the new connection is preferred over 
deleting existing mappings. See also the rationale in Section 6 
of [RFC5508]. 
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4. 


Logging 


It may be necessary for CGN administrators to be able to identify a 
subscriber based on external IPv4 address, port, and timestamp in 
order to deal with abuse. When multiple subscribers share a single 
external address, the source address and port that are visible at the 
destination host have been translated from the ones originated by the 
subscriber. 


In order to be able to do this, the CGN would need to log the 
following information for each mapping created (this list is for 
informational purposes only and does not constitute a requirement): 


o transport protocol 


o subscriber identifier (e.g., internal source address or tunnel 
endpoint identifier) 


o external source address 
o external source port 
o timestamp 


By "subscriber identifier" we mean information that uniquely 
identifies a subscriber. For example, in a traditional NAT scenario, 
the internal source address would be sufficient. In the case of DS- 
Lite, many subscribers share the same internal address and the 
subscriber identifier is the tunnel endpoint identifier (i.e., the 
B4’s IPv6 address). 


A disadvantage of logging mappings is that CGNs under heavy usage may 
produce large amounts of logs, which may require large storage 
volume. 


REQ-12: A CGN SHOULD NOT log destination addresses or ports unless 
required to do so for administrative reasons. 


Justification: Destination logging at the CGN creates privacy 
issues. Furthermore, readers should be aware of logging 
recommendations for Internet-facing servers [RFC6302]. With 
compliant servers, the destination address and port do not need to 
be logged by the CGN. This can help reduce the amount of logging. 


This requirement is at the SHOULD level to account for the fact 
that there may be other reasons for logging destination addresses 
or ports. One such reason might be that the remote server is not 
following [RFC6302]. 
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3% 


Port Allocation Scheme 


A CGN’s port allocation scheme is subject to three competing 
requirements: 


REQ-13: A CGN’s port allocation scheme SHOULD maximize port 
utilization. 


Justification: External ports are one of the resources being shared 
by a CGN. Efficient management of that resource directly impacts 
the quality of a subscriber’s Internet connection. 


Some schemes are very efficient in their port utilization. In 
that sense, they have good scaling properties (nothing is wasted). 
Others will systematically waste ports. 


REQ-14: A CGN’s port allocation scheme SHOULD minimize log volume. 
Justification: Huge log volumes can be problematic to CGN operators. 


Some schemes create one log entry per mapping. Others allow 
multiple mappings to generate a single log entry, which sometimes 
can be expressed very compactly. With some schemes, the logging 
frequency can approach that of DHCP servers. 


REQ-15: A CGN’s port allocation scheme SHOULD make it hard for 
attackers to guess port numbers. 


Justification: Easily guessed port numbers put subscribers at risk 
of the attacks described in [RFC6056]. 


Some schemes provide very good security in that ports numbers are 
not easily guessed. Others provide poor security to subscribers. 


A CGN implementation’s choice of port allocation scheme optimizes to 
satisfy one requirement at the expense of another. Therefore, these 
are soft requirements (SHOULD as opposed to MUST). 


Deployment Considerations 
Several issues are encountered when CGNs are used [RFC6269]. There 


is current work in the IETF toward alleviating some of these issues. 
For example, see [NAT-REVEAL]. 
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7. 


9. 


9. 


Security Considerations 


If a malicious subscriber can spoof another subscriber’s CPE, it may 

cause a DoS to that subscriber by creating mappings up to the allowed 
limit. An ISP can prevent this with ingress filtering, as described 

in [RFC2827]. 


This document recommends endpoint-independent filtering (EIF) as the 
default filtering behavior for CGNs. EIF has security considerations 
that are discussed in [RFC4787]. 


NATs sometimes perform fragment reassembly. CGNs would do so at 
presumably high data rates. Therefore, the reader should be familiar 
with the potential security issues described in [RFC4963]. 
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